Control circuit for automotive vehicle motion control systems

ABSTRACT

A control circuit for use with an automotive vehicle motion control system such as an anti-lock control (ABS) for an automotive vehicle brake system and/or traction slip control (TCS) includes circuits for processing sensor signals and for generating braking pressure control signals to enable hydraulic valves inserted into pressure fluid conduits of the brake system. The valve control signals are derived from the sensor signals by means of a single-chip microcontroller which processes the data in two successive or time-offset calculating operations performed according to different algorithms. The results of the calculating operations are temporarily stored and compared for coincidence. When the results differ from each other, their deviation is signaled to a monitoring circuit. In addition, the microcontroller is continuously tested by switch-on tests and, during operation, by cycle tests, self-tests, signature analyses and other known methods of error detection.

This application is the U.S. national-phase application of PCTInternational Application No. PCT/EP94/02274.

BACKGROUND OF THE INVENTION

The present invention relates to a control circuit for use with anautomotive vehicle motion control system such as an anti-lock control(ABS) for an automotive vehicle brake system and/or traction slipcontrol (TCS). Included in the present invention is a single-chipmicrocontroller for evaluating and processing data obtained by sensorsand representative of the rotational behavior of the individual vehiclewheels, and for generating braking pressure control signals which aredelivered to electrically commutable hydraulic valves inserted into thepressure fluid conduits of the brake system, and/or for generatingengine torque control signals. The microcontroller is constantly checkedon each activation, or as a function of other periodic events, andcyclically repeated during operation, by way of tests, self-tests, asignature analysis of the read-only memories and/or according to otherper se known methods of error detection. The present invention alsoincludes a monitoring circuit which deactivates or disconnects thecontrol partially or entirely in the case of an interference.

A control circuit of this type is disclosed in European patentapplication No. 0 357 922. This publication describes a method ofoperating a service brake device for a commercial vehicle and anelectronic control device for implementing the method. To evaluate andprocess the data obtained by sensors, a high-integration single-chipmicrocontroller is used which also comprises pulse-width modulators togenerate the valve control signals. An integral component part of themicroprocessor is a ROM-programmed test module performing a cyclicallyrepeated self-test which includes all important functions and operationsof the microcontroller. Further, the control device has a monitoringcircuit which resets the microcontroller to an initialization conditionin the case of defined malfunctions.

German patent No. 32 34 637 discloses a control circuit for an ABSsystem wherein the signals emitted by wheel sensors are processed in twoindependent, parallel, identically designed and identically programmedmicrocontrollers. The output signals of both microcontrollers arechecked for coincidence. If there are differences, the control isdeactivated or disconnected, thereby preserving the operability of thebrake system, though without control. Thus, the known control circuit isbased on a redundant signal processing in two complete circuits. Thesole purpose of the redundancy is to reliably detect malfunctions and todisconnect the control upon malfunction. The disconnecting mechanismsalso have a largely redundant design for the same reason.

There is no need for detailed explanations that the redundant signalprocessing by way of parallel operated, complete microcontrollersrequires complicated structure.

In another known circuit arrangement of this type which is described inGerman patent application No. 41 37 124, the sensor signals or inputsignals are conducted in parallel to two circuits. Only one of the twocircuits, however, performs the entire complicated signal processingoperation. Monitoring is the main purpose of the second circuit.Therefore, the input signals are processed further after conditioningand forming of derivatives by way of simplified control algorithms and asimplified control philosophy. The simplified processing operation issufficient to generate signals which permit concluding proper operationby comparison with the signals processed in the more sophisticatedmicrocontroller.

The signal processing operation effected by this known circuit is alsoredundant to a large extent, though with restrictions. Apart from thesophisticated microcontroller for the actual signal processing, there isneed for a second integrated circuit for the still complex, thoughsimplified reproduction of the control algorithms.

SUMMARY OF THE INVENTION

A general object of the present invention is to still more reduce thenecessary structure for the control circuit of the type initiallyreferred to, without a loss in the reliability of the control and thesafety of the error detection. Because it has previously been impossibleto include all types of errors, a still greater increase in safety is anobjective.

It has been found that this objective can be achieved by a controlcircuit of the type previously referred to. The special characteristicof the control circuit is that the single-chip microcontroller processesthe data in at least two successive or time-offset calculatingoperations, which are performed at least in part according to differentalgorithms, and that the results and/or the intermediate results of thecalculating operations are temporarily stored, compared and checked forcoincidence, and that differences in the calculation results or theintermediate results are signaled to the monitoring circuit.

While, previously, the redundancy of signal processing (i.e. theso-called "passive" redundancy for a reliable disconnection in the caseof an error) has been considered an absolutely necessary factor in acontrol circuit appropriate for brake systems, thus, requiting a controlcircuit structure with two parallel data-processing circuits, thepresent invention suggests obviating the need for this type ofredundancy. Instead, two different calculating operations, which mustcome to the same result, are performed successively or time-offset inone single microcontroller. Subsequently, the results of bothcalculating operations are compared. In addition, the operability of themicrocontroller is checked permanently by application of per se knownmethods of error detection.

A control circuit design according to the present invention permitsreducing the circuit structure (i.e. only one microcontroller isrequired) and, nevertheless, achieving a degree of safety with respectto malfunctions which is comparable with the safety of known circuits,or even improved. When parallel actuated, identically programmedmicrocontrollers are used, it is possible that the same error occurssimultaneously in both circuits during operation. This may be due tomask errors, for example, which cause the same effect in two integratedcircuits taken from the same batch. Such processor errors also aredetected in data processing operations according to differentalgorithms.

Different, per se known methods of error detection, which are achievedby way of the software, are used to continuously check the entiremicrocontroller. Self-tests on each operation of the controller, testsof the read-only memories (ROM) during operation by way of a so-calledsignature analysis and checking the random access memories (RAM) by wayof test samples for static and dynamic errors are some of the knownmethods applicable for the error detection.

In one embodiment of the present invention, the calculating operations,in which the input data are processed, are performed at least in part byaccess to values stored in tables. For example, calculation results arecompared with data taken from tables. Automatically, there aredifferences when data processing errors exist.

In another embodiment of the present invention, the microcontrollerfurnishes the monitoring circuit with an alternating signal, forexample, a pulse train signal of a defined frequency and signal shape inthe event of fail-free operation of the control circuit and dueperformance of the functions monitored by the microcontroller. In theabsence of an error, the characteristic values of the alternatingsignal, for example, the frequency, pulse duration and pulse pauses,must be in the range of predetermined limit values.

It is also possible to use a numerical signal instead of the alternatingsignal to indicate to the monitoring circuit the fail-free operation ofthe microcontroller or the existence of errors.

Another method of error detection is to check the input signals of themicrocontroller, the calculation results and/or the intermediate resultsfor plausibility and to signal "hardly possible" signals, results orresult combinations as errors to the monitoring circuit.

According to another preferred aspect of the present invention, theelectric characteristic values of the hydraulic valves controlled by themicrocontroller, the magnitude of the supply voltages for the hydraulicvalves and for the electronic circuits, and the condition of theswitches used to disconnect the control on malfunction are taken intoaccount for the monitoring operations by the microcontroller or by themonitoring circuit. Further, the connecting lines and the electricalpart of the hydraulic valves are, expediently, checked for lineinterruptions, short-circuits or leakage currents by the microcontrollerand/or the monitoring circuit. Other components of the control circuit,such as clock generators, timers, etc., can also be included in themonitoring operations in a known fashion.

Further, it is appropriate to check the operability of the monitoringcircuit by a switch-on or switch-off test and/or by test signals issuedby the microcontroller. Thus, all circuits, even the test circuitsthemselves, are included in the tests.

According to still another preferred aspect of the present invention,the malfunctions are evaluated by the microcontroller and/or themonitoring circuit; and the control is deactivated or disconnected onlyif the duration of the malfunctions or the frequency per time unitexceeds predetermined tolerance thresholds. Typically, short-timemalfunctions have no influence, or a negligible influence, on thebraking effect. Relatively harmless errors or rarely occurring errorsshould be at least indicated. Errors of grave implication, which mightjeopardize the braking function, cause disconnection of the controlcircuit. Also, the reaction to errors can be made a function of whetheran ABS or a TCS control operation is performed, or whether there is nocontrol operation at the moment considered.

Further features, advantages and possible applications of the presentinvention can be taken from the following description of embodimentswith reference to the accompanying drawings.

In the drawings:

FIG. 1 is a block diagram view of the basic components of a controlcircuit in accordance with an exemplary embodiment of the presentinvention.

FIG. 2 is a view of further details of the microcontroller design of thecontrol circuit in FIG. 1.

FIG. 3 is an exemplary flow chart of the check for coincidence ofcalculation results in the microcontroller of the control circuit ofFIG. 1.

FIG. 4 is an exemplary flow chart of an error detection operation by acyclic signature analysis.

DETAILED DESCRIPTION

Components of a control circuit in accordance with an exemplaryembodiment of the present invention, as shown in FIG. 1, include asingle-chip microcontroller 1, a monitoring circuit 2, a semiconductorswitch or a relay S1 to connect and disconnect the current supply forthe valve coils V1, V2, Vn of hydraulic valves (not shown) and thesemiconductor switches or transistors S11, S12, S1n to actuate the valvecoils V1, V2, Vn. In the actuating path of the transistors S11, S12,S1n, there are AND gates G1, G2, Gn having two inputs each, by way ofwhich the gates are connected to the microcontroller 1, on the one hand,and to the monitoring circuit 2, on the other hand. Also, in FIG. 1,there is an actuating transistor S1W1 for a warning lamp WL, clockgenerators TG1, TG2 to generate the operating cycles for the twointegrated circuits, i.e., for the microcontroller 1 and the monitoringcircuit 2. FIG. 1 also shows multiple lines which furnish themicrocontroller, by way of the inputs E1, E2, with the wheel sensorsignals (through E1) and further pieces of information (through E2) suchas hydraulic valve operating status. Connections V_(C1) and V_(C2) servefor the voltage supply of the microcontroller 1 and the monitoringcircuit 2, while the valves V1, V2, Vn are supplied with voltage fromthe battery U_(B) by way of the semiconductor switch S1.

Further, an AND gate G3 is provided in the actuating path of thesemiconductor switch S1 delivering an enable signal for thesemiconductor switch S1 if both the monitoring circuit 2 and themicrocontroller 1 determine a fail-free operation and issue acorresponding signal to actuate the switch S1 by way of the AND gate G3.

The middle connection of a voltage divider R1, R2 leads to an input E3of the microcontroller 1. By way of this input, the microcontrollerchecks the existence and the magnitude of the voltage for the supply ofthe valve coils V1, V2, Vn. The switch condition of the valve actuatingtransistors S11, S12, S1n is signaled to the microcontroller 1 throughthe inputs E4, E5, E6. A line interruption, a short-circuit or an(increased) leakage current in the path to the valve coils V1, V2, Vncan be seen also by way of the inputs E4 to E6. Further monitoringoperations can be achieved by logically combining the input signals andcomparing them with the valve actuating signals.

The microcontroller 1 and the monitoring circuit 2 are interconnected bysignal lines leading in both directions. Through line WD ("watch dog"),the microcontroller 1 issues to the monitoring circuit 2 an alternatingsignal or a numerical signal providing information about the fail-freeoperation and the fail-free condition of the microcontroller 1 and thefunctions monitored by the microcontroller. Some of the functions havebeen mentioned hereinabove. In addition, the monitoring circuit 2 may bechecked for operability by a switch-on or switch-off test and/or by testsignals issued by microcontroller 1; as disclosed in for example U.S.Pat. No. 5,411,324. The watch dog signal WG, or its frequency, pulseshape or numerical content, is within predetermined limit values only ifmalfunctions do not exist. Besides, it is possible to check the piecesof information and measured values, which are introduced through inputsE1, E2 and, above all, are representative of the rotational behavior ofthe individual wheels, for plausibility.

If the measured values or the combinations of measured values indicatestates which are not "plausible" (because they are physicallyimpossible, for example), there must be an error. The error is signaledto the monitoring circuit by the watch dog signal WG. Depending on thedesign of the monitoring system, an error causes immediate disconnectionof the control, or the occurring error is "assessed" and causesdifferent reactions in response to the result of the assessment. Someerrors are tolerable for a short time, others involve a risk for thedriving stability or the braking operation and, thus, require immediatedisconnection of the control. A number of variants are possible withrespect to the type of error and the reaction.

Another main feature of the control circuit according to the presentinvention is explained with regard to the exemplary embodiment of FIG. 2in conjunction with the exemplary embodiment of FIG. 1. The individual,partly very complicated, calculating operations or algorithms, whichinclude the so-called control philosophy and are required duringanti-lock or traction slip control operations to generate the valvecontrol signals as a function of the input signals, or to generatetorque control signals; as disclosed (for example) in European PatentApplication 0 434 059 are carried out in the microcontroller at leasttwo times successively (or time-offset) according to the presentinvention. Different calculating methods or algorithms are chosen atleast for part of the successive or time-offset calculating operations,which must achieve the same results or intermediate results. Tablevalues can also be used for the calculating operations. The applicationof different calculating methods or algorithms for the same calculatingoperations causes non-coincidence of the results or the intermediateresults when the microcontroller has structural defects or programmingerrors or has failed for other reasons.

The microcontroller 1 of the control circuit according to an exemplaryembodiment of the present invention as illustrated by FIG. 2 comprisesthe actual main part 3 of the processor and additional circuits 4. Thedotted horizontal line of separation represents this distinction. Themain processor part includes the processor unit ALU, a read-only memoryROM and a random access memory RAM. Further, there are periphery inputcircuits 5 and periphery output circuits 6. The input signals areintroduced and the output signals are emitted through these circuits,respectively. The above-mentioned units are interconnected by signallines. The direction(s) of transmission of the signal lines is indicatedby arrows in FIG. 2.

The microcontroller component with the additional circuits 4 includesthe result registers A and B, which are essential for the presentinvention and record the results and/or the intermediate results of thesuccessive or time-offset calculating operations. The signal lines orthe data bus extending from the processor ALU of the main part 3 of themicrocontroller to the result registers A, B are designated by referencenumerals 7, 7A and 7B in FIG. 2. The memory commands are transmitted tothe register A or B through lines 8', 8", respectively.

The contents of the registers A and B are supplied to a comparator 9which detects a complete or incomplete coincidence of the comparedsignals, or differences between them. Finally, the output signal of thecomparator is assessed in a unit 10. The assessed comparison result thendetermines the contents or the characterizing features of the watch dogsignal WD which is delivered to the monitoring circuit 2, as shown inFIG. 1. Of course, the data and test results of the other testingoperations, for example, introduced through the inputs E3 to E6 to theassessing unit 10 can be taken into account before generating the watchdog signal WG.

In the assessment of the comparison results, which can be effected bythe unit 10 of the microcontroller 1 and/or in the monitoring circuit 2,the errors or differences are appropriately assessed for the controldepending on the type, the duration or frequency, or the importance ofthe error. The result of this assessment determines whether the controlis deactivated or disconnected, immediately or with delay, temporarilyor permanently.

The flow chart in FIG. 3 shows in a simplified way the program part,which is important for the present invention and is carried out by wayof the result registers A and B described in FIG. 2. The individualsteps and commands are indicated in FIG. 3. In the absence ofdifferences in the comparison, the calculating program will continue;otherwise, a command to disconnect the control is issued.

In addition, the application of known software methods for the detectionof errors within the microcontroller increases the safety andreliability of the control circuit according to the present invention.Tests, self-tests, signature analyses, etc., of a known type are carriedout on each connection or disconnection of the microcontroller or independence on other periodic events, in predetermined time intervals,etc., and cyclically repeating during operation. Information changes inthe read-only memory (ROM), which are due to errors, can be detected bychecking the contents of the read-only memory by way of the knownsignature analysis. The flow chart of FIG. 3 relates to this method. Inrandom access memories (RAM), static and dynamic errors in addressing,storing and reading can be detected by known checking methods using testsamples. For example, an inverse element is entered in a memory withuniform values, and, subsequently, all other elements are checked for acorrect content. After each reading operation in one of the cells, thetest cell is checked. This action is repeated for all elements. A secondtest run is performed with the inverse memory space allocation of theentire memory.

The flow chart in FIG. 4 shows the individual steps of the cyclicallyrepeated signature analysis for checking a read-only memory. The mainprogram starts the signature analysis at determined times when admittedby the program run. The individual program steps, their order and thedecision points are shown in FIG. 4. The illustrated cycle of command 11("get contents of the ROM cell for checking") to command 13 ("return tothe main program") is successively repeated for all ROM cells. For theerror detection, the result is compared with a predetermined programmedvalue in program step 12.

The operation of the timers, their time behavior, the correct formationof increment or decrement, etc., is checked by other cycle tests.

Finally, the results of all tests are recorded in the watch dog signalWD and transmitted to the monitoring circuit 2.

Thus, a control circuit is provided on the basis of one singlemicrocontroller in conjunction with a monitoring circuit, according tothe present invention. The immediate detection and signaling of errorsof different types is ensured by data processing, which is essential tothe present invention, i.e. by successive or time-offset calculatingoperations according to different algorithms in conjunction withperiodic and cyclically repeated tests.

We claim:
 1. A control circuit for use in automotive vehicle brakesystems with at least one of (a) anti-lock control (ABS) and (b)traction slip control (TCS), including a microcontroller for evaluatingand processing data obtained by sensors and representative of therotational behavior of the individual vehicle wheels, and for at leastone of (a) generating braking pressure control signals which aredelivered to electrically commutable hydraulic valves inserted into thepressure fluid conduits of the brake system, and (b) generating enginetorque control signals, wherein the microcontroller is constantlychecked on each activation, or as a function of other periodic events,by way of tests, self-tests, or a signature analysis of the read-onlymemories and including a monitoring circuit which deactivates ordisconnects the control partially or entirely in the case of aninterference, characterized in that the single-chip microcontrollerprocesses the data in at least two successive or time-offset calculatingoperations, which are performed at least in part according to differentalgorithms, in that at least one of the results and the intermediateresults of the calculating operations are temporarily stored, comparedand checked for coincidence, and in that differences in the calculationresults or the intermediate results are signaled to the monitoringcircuit.
 2. A control circuit as claimed in claim 1, characterized inthat the calculating operations are performed at least in part by usingvalues stored in tables.
 3. A control circuit as claimed in claim 1,characterized in that the microcontroller delivers an alternating signalof a defined frequency and signal shape to the monitoring circuit infail-free operation of the control circuit and due performance of thefunctions monitored by the microcontroller.
 4. A control circuit asclaimed in claim 3, characterized in that the alternating signal is apulse train signal, and the pulse times and times of pulse pause of thesignal are within the range of predetermined limit values, with properfunction of the control circuit.
 5. A control circuit as claimed inclaim 1, characterized in that the microcontroller issues numericalsignals to the monitoring circuit to indicate the fail-free operation ofthe control circuit and the functions monitored by the microcontroller.6. A control circuit as claimed in claims 1, characterized in that theinput signals of the microcontroller, the calculation results or theintermediate results are checked for plausibility, and in that theoccurrence of non-expected signals, results or result combinations israted as an error and signaled to the monitoring circuit.
 7. A controlcircuit as claimed in claim 1, characterized in that the state and thefunction of the hydraulic valves actuated by the microcontroller, themagnitude of the supply voltages for the hydraulic valves and for theelectronic circuits, and the condition of one or more of the switchesused to disconnect the control is taken into account for the monitoringoperation by the microcontroller.
 8. A control circuit as claimed inclaim 1, characterized in that the connecting lines and the electricalpart of the hydraulic valves are checked for line interruptions,short-circuits or leakage currents by the microcontroller and/or themonitoring circuit.
 9. A control circuit as claimed in claim 1,characterized in that the monitoring circuit is checked for operabilityby at least one of (a) a switch-on or switch-off test and (b) testsignals issued by the microcontroller.
 10. A control circuit as claimedin claim 1, characterized in that the microcontroller and the monitoringcircuit evaluates the malfunctions and deactivates or disconnects thecontrol if the duration of the malfunctions or the frequency of themalfunctions per time unit exceeds predetermined tolerance thresholds.11. A control circuit as claimed in claim 1, characterized in that themicrocontroller and the monitoring circuit evaluates the malfunctionsand disconnects the control if a malfunction occurs which jeopardizesthe braking effect.
 12. A control circuit for use with an automotivevehicle motion control system, comprising:receiving means for receivingsignals which indicate rotational behavior of at least one wheel;processing means for processing said received signals using two separateand at least partially different algorithms which are expected togenerate corresponding results; storage means for storing at least oneof results and temporary results generated by said two algorithms;comparing means for comparing said stored one of results and temporaryresults; and signaling means for signaling the motion control system ifsaid comparison indicates a difference.
 13. A control circuit accordingto claim 12, wherein said processing means is a single chipmicrocontroller which generates at least one of:(a) braking pressurecontrol signals which are delivered to electrically commutable hydraulicvalves inserted into pressure fluids conduits of a brake system; and (b)engine torque control signals.
 14. A control circuit according to claim12, wherein said processing means is checked on one of (a) activation,and (b) a function of periodic events, by way of at least one of test,self-test, signature analysis, and error detection.
 15. A controlcircuit according to claim 12, wherein said processing means processessaid received signals in at least one of successive and time-offsetcalculating operations.
 16. A control circuit according to claim 12,wherein said processing means processes said received signals usingvalues stored in tables.
 17. A control circuit according to claim 12,wherein an alternating signal of defined frequency and signal shape isgenerated by said comparing means if there is fail-free operation ofsaid processing means.
 18. A control circuit according to claim 17,wherein said alternating signal is a pulse train signal within apredetermined range of attributes if the control circuit is operatingproperly.
 19. A control circuit according to claim 12, wherein thecontrol circuit generates numerical signals to indicate fail-freeoperation of said processing means.
 20. A control circuit according toclaim 12, wherein said one of results and temporary results are checkedfor plausibility and wherein improper results or temporary results aredetermined to be an error.
 21. A control circuit according to claim 12,wherein the automotive vehicle motion control system includes hydraulicvalves which are actuated by said processing means and wherein functionof said hydraulic valves and a supply voltage for said hydraulic valvesis monitored by said processing means to determine whether a signalshould be generated to suspend control by the automotive vehicle motioncontrol system.
 22. A control circuit according to claim 21, wherein atleast one of connecting lines and electrical components of saidhydraulic valves are checked for at least one of line interruptions,short circuits, and leakage currents by said processing means.
 23. Acontrol circuit according to claim 12, wherein said comparison meanssignals a monitoring circuit if said comparison indicates a difference,and said control circuit further comprises means for checkingoperability of said monitoring circuit by one of a switch-on/switch-offtest and test signals generated by said processing means.
 24. A controlcircuit according to claim 12, further comprising:(a) a monitoringcircuit for being signaled by said signaling means as said comparisonindicates a difference, and (b) means for evaluating malfunctions in atleast one of said processing means and said monitoring circuit and fordeactivating or disconnecting control of the control circuit if durationof malfunctions or frequency of malfunctions per time unit exceedspredetermined tolerance thresholds.
 25. A control circuit according toclaim 24, wherein at least one of said processing means and saidmonitoring circuit evaluates malfunctions and disconnects control of theautomotive vehicle motion control system if a malfunction occurs whichjeopardizes expected braking effects.
 26. A method of controlling anautomotive vehicle motion control system comprising the steps of:(a)receiving signals which indicate rotational behavior of at least onewheel; (b) processing said received signals using two separate and, atleast, partially different algorithms which are expected to generatecorresponding results; (c) storing at least one of results and temporaryresults generated by said two algorithms in separate storage locations;(d) comparing said stored one of results and temporary results; and (e)signaling the motion control system if said comparison indicates adifference.